Unmaintained advisory for humantime by oherrala · Pull Request #2249 · rustsec/advisory-db

oherrala · 2025-03-08T12:51:07Z

Last crates.io release 2021-01-13 and no GitHub commits since 2021-12-28.

Question about maintenance status posted 2022-08-04 with no answer from maintainer: chronotope/humantime#31

This crate has some big dependents like clap (with 20309 dependents) and env_logger (with 8090 dependents).

Update 2025-03-10: env_logger 0.11.7 dropped humantime dependency in favor of jiff.

tarcieri · 2025-03-08T14:32:01Z

This one seems tricky due to the large numbers of downstream dependencies (I see cargo is also among them). It would be very noisy to publish an advisory.

For starters, it would probably be good to open an issue on env_logger at least and see if they're willing to transition to something else.

oherrala · 2025-03-08T15:30:35Z

@tarcieri Agreed.

I made a simple PR to env_logger for testing it with cyborgtime: rust-cli/env_logger#351

oherrala · 2025-03-08T15:39:24Z

Another alternative to cyborgtime is jiff:

https://docs.rs/jiff/latest/jiff/fmt/friendly/index.html#comparison-with-the-humantime-crate

Ref. clap-rs/clap#5943 (comment)

oherrala · 2025-03-10T16:48:08Z

env_logger just released 0.11.7 that dropped humantime in favor of jiff: https://github.com/rust-cli/env_logger/releases/tag/v0.11.7

tarcieri · 2025-03-10T16:59:48Z

It would be good to wait for a clap release before merging, IMO

This is another big user of humantime whose usages also seem pretty trivial and easy to switch to jiff: https://github.com/apache/arrow-rs

oherrala · 2025-03-10T18:07:26Z

@tarcieri I just opened PR to fix object_store: apache/arrow-rs#7261

oherrala · 2025-03-10T18:45:49Z

Analysis of some more humantime dependants sorted by most crates.io downloads:

humantime-serde whole crate can be replaced by jiff
fern only using as dev dependency
sval only using as dev dependency
console-subscriber looks like easy to fix with jiff
prodash opt-in feature, not enabled by default
log4rs looks like easy to fix with jiff
cucumber looks like easy to fix with jiff
cargo looks like easy to fix with jiff

tarcieri · 2025-03-10T19:32:59Z

cargo definitely seems concerning

oherrala · 2025-03-10T20:16:03Z

PR about switching cargo to jiff: rust-lang/cargo#15290

The crate [`humantime`](https://crates.io/crates/humantime) appears to be unmaintained. There's open PR in RustSec's advisory-db about this: rustsec/advisory-db#2249 The crates [`clap`](https://crates.io/crates/clap) and [`env_logger`](https://crates.io/crates/env_logger) have already made the switch from `humantime` to [`jiff`](https://crates.io/crates/jiff): * clap-rs/clap#5944 * rust-cli/env_logger#352 The `jiff` crate is already dependency on `cargo` via `gix` (albeit old 0.1 version, but that's probably fixed in [next gix release](GitoxideLabs/gitoxide@3ae99a4)): ``` jiff v0.1.29 └── gix-date v0.9.3 ├── gix v0.70.0 │ └── cargo v0.88.0 (/Users/oherrala/rust/cargo) ``` This PR shouldn't have any functional change to cargo itself.

oherrala · 2025-03-10T21:38:01Z

@tarcieri cargo merged change to replace humantime with jiff: rust-lang/cargo#15290

tarcieri · 2025-03-10T21:58:50Z

Cool. ~~I'd say just wait for a clap release with the migration to jiff and we can merge this advisory.~~

Edit: oh hey, I guess clap v4.5.32 is out with the change. Let me give it one lass pass.

this commit replaces `humantime`, which is no longer maintained, with `jiff`. see this error when `main` today is built: ``` error[unmaintained]: humantime is unmaintained ┌─ /linkerd/linkerd2-proxy/Cargo.lock:78:1 │ 78 │ humantime 2.1.0 registry+https://github.com/rust-lang/crates.io-index │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected │ ├ ID: RUSTSEC-2025-0014 ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0014 ├ Latest `humantime` crates.io release is four years old and GitHub repository has not seen commits in four years. Question about maintenance status has not gotten any reaction from maintainer: chronotope/humantime#31 ## Possible alternatives * [jiff](https://crates.io/crates/jiff) provides same kind of functionality ├ Announcement: chronotope/humantime#31 ├ Solution: No safe upgrade is available! ├ humantime v2.1.0 └── linkerd-http-access-log v0.1.0 └── linkerd-app-inbound v0.1.0 ├── linkerd-app v0.1.0 │ ├── linkerd-app-integration v0.1.0 │ └── linkerd2-proxy v0.1.0 ├── linkerd-app-admin v0.1.0 │ ├── linkerd-app v0.1.0 (*) │ └── (dev) linkerd-app-integration v0.1.0 (*) └── linkerd-app-gateway v0.1.0 └── linkerd-app v0.1.0 (*) advisories FAILED, bans ok, licenses ok, sources ok ``` see: * rustsec/advisory-db#2249. * chronotope/humantime#31. Signed-off-by: katelyn martin <[email protected]>

The `huamntime` crate briefly had unmaintained status, for which RUSTSEC-2025-0014. It has since become maintained again, and that advisory has been withdrawn, so this removes it from the list of advisores we allow `cargo deny` to ignore. Background: - https://rustsec.org/advisories/RUSTSEC-2025-0014.html (advisory) - rustsec/advisory-db#2249 (issued) - rustsec/advisory-db#2252 (withdrawn) - cf7f34d in GitoxideLabs#1882 (commit that ignored it, among other changes)

The `humantime` crate briefly had unmaintained status, for which RUSTSEC-2025-0014 was issued. It has since become maintained again, and that advisory has been withdrawn. So this removes it from the list of advisores we allow `cargo deny` to ignore. Background: - https://rustsec.org/advisories/RUSTSEC-2025-0014.html (advisory) - rustsec/advisory-db#2249 (issued) - rustsec/advisory-db#2252 (withdrawn) - cf7f34d in GitoxideLabs#1882 (commit that ignored it, among other changes)

oherrala mentioned this pull request Mar 8, 2025

chore(deps): Switch humantime to cyborgtime clap-rs/clap#5943

Closed

oherrala mentioned this pull request Mar 8, 2025

Replace humantime with cyborgtime rust-cli/env_logger#351

Closed

This was referenced Mar 8, 2025

chore(deps): Switch humantime to jiff clap-rs/clap#5944

Merged

chore(deps): Switch humantime to jiff rust-cli/env_logger#352

Merged

Unmaintained advisory for humantime

a8681b8

oherrala force-pushed the humantime branch from d2193c4 to a8681b8 Compare March 10, 2025 16:52

oherrala mentioned this pull request Mar 10, 2025

Replace humantime crate with jiff apache/arrow-rs#7261

Closed

oherrala mentioned this pull request Mar 10, 2025

Replace unmaintained humantime crate with jiff rust-lang/cargo#15290

Merged

tarcieri approved these changes Mar 10, 2025

View reviewed changes

tarcieri merged commit 23853f2 into rustsec:main Mar 10, 2025

oherrala deleted the humantime branch March 10, 2025 22:01

This was referenced Mar 11, 2025

chore: Change to use jiff crate sorairolake/scryptenc-rs#569

Merged

Replace humantime crate sharkdp/fd#1689

Closed

cratelyn mentioned this pull request Mar 12, 2025

chore(deps): address RUSTSEC-2025-0014 linkerd/linkerd2-proxy#3750

Merged

EliahKagan mentioned this pull request Mar 18, 2025

Delist withdrawn RUSTSEC-2025-0014 GitoxideLabs/gitoxide#1893

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Unmaintained advisory for humantime#2249

Unmaintained advisory for humantime#2249
tarcieri merged 1 commit into
rustsec:mainfrom
oherrala:humantime

oherrala commented Mar 8, 2025 •

edited

Loading

Uh oh!

tarcieri commented Mar 8, 2025

Uh oh!

oherrala commented Mar 8, 2025

Uh oh!

oherrala commented Mar 8, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

tarcieri commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

tarcieri commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

tarcieri commented Mar 10, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

oherrala commented Mar 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tarcieri commented Mar 8, 2025

Uh oh!

oherrala commented Mar 8, 2025

Uh oh!

oherrala commented Mar 8, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

tarcieri commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

tarcieri commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

oherrala commented Mar 10, 2025

Uh oh!

tarcieri commented Mar 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

oherrala commented Mar 8, 2025 •

edited

Loading

tarcieri commented Mar 10, 2025 •

edited

Loading